A critical vulnerability, CVE-2022-41952, was discovered in Matrix Synapse, the reference Matrix homeserver written in Python. This issue affects all Synapse versions before 1.52. that have URL preview functionality enabled. In this deep dive, we'll explain how the bug works, how it can be exploited, and what steps you must take to fix or mitigate the risk.

What’s The Problem?

When someone posts a livestream (e.g., Icecast) URL in a chat room, Synapse tries to preview it — but doesn’t properly time out the connection. That means it keeps downloading the stream until it hits a size limit (by default, 10MB), even if the stream is endless.

Imagine that stream URL is posted to a big public room with hundreds of homeservers (each running Synapse). Suddenly, they all try to fetch the stream for preview! They keep the connection open for a long time, creating excessive load on the streaming server. Worse, previews for streams never succeed, so this is pointless traffic.

# homeserver.yaml
url_preview_enabled: true
max_spider_size: 10M   # default value

The Vulnerability

# Simplified pseudocode

def generate_url_preview(url):
    conn = open_connection(url)
    data = b''
    while len(data) < max_spider_size:
        chunk = conn.read()
        if not chunk:
            break
        data += chunk
    # Problem: No timeout! Connection hangs until max_spider_size bytes are read (10MB)
    # For streams, this can take a LONG time.
    conn.close()

So, if someone posts a streaming URL (like http://mystream.example.com/live.ogg), Synapse’s spider keeps the connection open and consumes bandwidth until 10MB is reached, which could take minutes for a media stream.

If multiple Synapse servers do this at once, the stream server is overloaded.

Exploit Scenario

1. An attacker posts an Icecast/SHOUTcast or similar stream URL to a busy Matrix room.

The streaming server is hammered with open connections and wasteful traffic.

Note: There is no personal data leaked. The issue is Denial of Service (DoS) towards streaming servers and excessive traffic for Synapse instances themselves.

Version 1.52.: Adds a Timeout

This release introduces a timeout for preview connections. By default, streaming previews will be aborted after 30 seconds.

* Release notes for v1.52.

# Pseudocode for fix

def generate_url_preview(url):
    conn = open_connection(url, timeout=30)  # 30 seconds timeout
    # The rest stays mostly the same

Version 1.53.: Adds a Content-Type Allowlist

Since previews for media streams always fail, v1.53. introduces a Content-Type allowlist: Synapse only tries previews for safe content types (like text or images), and skips known unsupported types (like audio or video streams).

* Release notes for v1.53.

How To Protect Yourself

The best fix:
Upgrade your Synapse to version 1.53. or later.

pip install --upgrade matrix-synapse

Or, using your system's package manager.

If you cannot upgrade immediately, you can disable the URL preview feature entirely

# homeserver.yaml
url_preview_enabled: false

Live Demo

Here’s how you might simulate the problem with a simple Python HTTP server pretending to be a stream:

import time
from http.server import BaseHTTPRequestHandler, HTTPServer

class StreamingHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header('Content-type','audio/ogg')
        self.end_headers()
        chunk = b'x' * 1024  # 1KB per send
        for _ in range(60 * 100):  # Stream for ~60 seconds
            self.wfile.write(chunk)
            time.sleep(.1)

if __name__ == '__main__':
    server = HTTPServer(('localhost', 800), StreamingHandler)
    server.serve_forever()

When old Synapse versions connect for a preview, they’ll stay open for a long time, downloading until the spider size limit is hit, not timing out.

References

- CVE-2022-41952 — NVD entry
- Synapse Security Advisories
- Official Release Note v1.52.
- Official Release Note v1.53.

Conclusion

If you run a Matrix Synapse server, do not ignore this bug. Even if you aren’t affected directly, someone could use your Synapse instance to DDoS someone else’s media server by requesting endless streams for previews. The only solid solution is to upgrade to Synapse 1.53. or newer, or disable URL previews. Stay safe and keep your servers updated!


*© 2024 – Exclusive technical breakdown by ChatGPT. All code is for educational purposes.*

Timeline

Published on: 11/22/2022 16:15:00 UTC
Last modified on: 07/06/2023 13:37:00 UTC